MWDB Training - Home

Workshop slides

Slides from the hack.lu workshop can be found here

Exercises

• Part 1 - MWDB
  • Exercise #1.0: Getting familiar with the interface
  • Exercise #1.1: Filtering samples by tags
  • Exercise #1.2: Exploring sample view and hierarchy
  • Exercise #1.3: Looking for similar configurations
  • Exercise #1.4: Blobs and dynamic configurations
  • Exercise #1.5: Let’s upload something!
• Part 2 - mwdblib
  • Setup
  • Exercise #2.1: Get information about 10 recent files using mwdblib
  • Exercise #2.2: Check properties of 780e8fb254e0b8c299f834f61dc80809
  • Exercise #2.3: Using mwdblib CLI
  • Exercise #2.4: Joining CLI with other tools
• Part 3 - Karton
  • Setup
  • Exercise #3.1: Adding new service to the Karton pipeline
  • Exercise #3.2: Write your own service
• Part 4 - Malduck
  • Setup
  • Exercise #4.1: Getting familiar with Malduck
  • Exercise #4.2: Extracting Warzone RAT C2 server info
  • Exercise #4.3: Creating extraction modules from the ground up
  • Exercise #4.4: Bonus: Integrating implemented modules into karton-config-extractor

Prerequisites

Open a terminal and check if these tools are installed:

• Python 3 (recommended 3.8 or newer)

  $ python3 -m pip
  

• Git

  $ git
  

• Docker engine with Docker Compose

  $ docker-compose
  

  Docker Engine installation instructions for Ubuntu (docs.docker.com)

  Docker Compose installation instructions (docs.docker.com)

Recommended environment is Ubuntu 20.04/22.04. Software used in training was not tested on other platforms (e.g. Mac OS, Windows), so prepare a fresh Ubuntu VM for the best workshop experience, especially if your host environment is unusual.

Guides for exercises

• mwdb-core - Advanced search based on Lucene queries

• mwdblib - Guide for REST API and mwdblib usage

• mwdblib - API reference

• karton - documentation

• malduck - API reference